use untrusted settings in hgweb The only exceptions are web.static and web.templates, since they can be used to get any file that is readable by the user running the CGI script. Other options can be (ab)used to increase the use of the cpu (allow_bz2) or of the bandwidth (server.uncompressed), but they're trusted anyway.

#!/bin/sh

hg init

mkdir alpha
touch alpha/one
mkdir beta
touch beta/two

hg add alpha/one beta/two
hg ci -m "start" -d "1000000 0"

echo 1 > alpha/one
echo 2 > beta/two

echo EVERYTHING
hg diff --nodates

echo BETA ONLY
hg diff --nodates beta

echo INSIDE BETA
cd beta
hg diff --nodates .